Timeline for risk threat vulnerability
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 26, 2019 at 7:09 | comment | added | schroeder♦ | Yes, I'm not saying your model is wrong, I'm saying that it's not relevant to this question. The question is about assessing the relationship between threat and vulnerability. You are bypassing that entire discussion to talk about impact and likelihood instead. Your recent edits drift further from what the OP asked. | |
| Apr 26, 2019 at 5:55 | history | edited | HTKLee | CC BY-SA 4.0 |
Updated to include much more information on doing a semi-quantitative risk assessment
|
| Apr 25, 2019 at 22:47 | comment | added | HTKLee | The model I describe of assessing risk (OWASP Risk Rating Methodology) is derived from the same ENISA document OP referenced - it's pretty much a spot on implementation of ENISA concepts. | |
| Apr 25, 2019 at 21:59 | comment | added | schroeder♦ |
risk = impact x likelihood is a common relationship to use. risk = threat x vuln x [consequence | asset] is another representation for information security risks. So you describe one way of assessing risk, but it does not address the approach the OP uses.
|
|
| Apr 25, 2019 at 8:10 | history | edited | HTKLee | CC BY-SA 4.0 |
grammatical accuracy
|
| Apr 25, 2019 at 8:00 | history | answered | HTKLee | CC BY-SA 4.0 |